Someone is connected to that PC. Who, and from where?
Session history is for afterwards. The question that comes up in a hurry is
different: there is a screen open on the finance PC right now, who is on it, where
are they, and how do I end it?
Two usernames, and they are often different people
Every live session shows both the portal account whose credentials opened it and
the Windows account signed in to the PC those credentials were typed on. On a
shared engineering workstation those are routinely different people, and knowing
which is which is the difference between calling the right person and the wrong
one.
We label which facts are observed and which are reported. The addresses and the
portal account come from the connection itself. The machine name and the Windows
user are reported by the client, so they are a lead rather than proof, and the
page says so rather than presenting all five as equally solid.
Both addresses
The public address is what the server sees. The private one is what the engineer’s
machine reports about its own network. Behind NAT a dozen engineers share one
public address, and the private one is what identifies the desk.
Stopping it means choosing what was wrong
Ending the session closes the screen. If the person can simply reconnect, that has
not solved anything – so the same panel offers three kinds of block, and they are
genuinely different:
- The address stops everyone behind it, colleagues included. Right when the
traffic looks wrong and you do not yet know who is behind it. - The account stops one person wherever they connect from, and signs them out
everywhere immediately. Right for credentials you think have been stolen. - The machine stops one PC without touching the person. Right for a laptop that
has gone missing.
Picking the wrong one is the usual mistake. Disabling an account because the
traffic looked odd punishes an engineer whose password was stolen; blocking an
address does nothing about somebody who moves. The page says what each costs so
the choice is made deliberately.